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A quantum string seal encodes the value of a (bit) string as a quantum state in such a way that 
everyone can extract a non-negligible amount of available information on the string by a suitable 
measurement. Moreover, such measurement must disturb the quantum state and is likely to be 
detected by an authorized verifier. In this way, the intactness of the encoded quantum state plays 
the role of a wax seal in the digital world. Here I analyze the security of quantum string seal 
by studying the information disturbance tradeoff of a measurement. This information disturbance 
tradeoff analysis extends the earlier results of Bechmann-Pasquinucci et al. and Chau by concluding 
that all quantum string seals are insecure. Specifically, I find a way to obtain non-trivial available 
information on the string that escapes the verifier's detection with at least 50% chance. 
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I. INTRODUCTION 

The idea of quantum seal was introduced by 
Bechmann-Pasquinucci to capture the essence of an en- 
velop with sealed wax in the digital world [J] . Specifically, 
a quantum (bit) seal is a method to encode a classical bit 
by some quantum particles in such a way that everyone 
can find out the value of the bit with high chance by 
an appropriate measurement. Moreover, any such mea- 
surement must disturb the state of the quantum particles 
so that an authorized person, who has some extra infor- 
mation on the state of the particles, can detect such a 
measurement with high probability 

A few quantum sealing schemes have been proposed. 
They fall into the following three types. The original 
scheme by Bechmann-Pasquinucci [ij and the one by 
Chau are perfect quantum bit seals because every- 
one can find out the value of the bit with certainty. The 
quantum bit seals introduced by Singh and Srikanth 
as well as He Q are imperfect quantum bit seals as read- 
ers cannot correctly determine the value of the bit with 
certainty. Recently, He 3 extended the notion of sealing 
a bit to sealing a bit string in a natural way by propos- 
ing an imperfect quantum bit string seal which separately 
encodes each bit of a classical string. Parameters in He's 
scheme are set in such a way that one has a high chance to 
correctly extract a large portion of the string. However, 
one has negligibly small chance to correctly determine 
the whole string Q. 

Density matrices representing any two distinct classi- 
cal messages in a perfect quantum seal must be orthogo- 
nal. Hence, there exits a projective measurement to find 
out the encoded message without disturbing the quan- 
tum state. Using this idea, Bechmann-Pasquinucci et al. 
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proved the insecurity of all perfect quantum (bit) seals 
provided that one has access to a quantum computer . 
Recently, He showed certain bounds relating the infor- 
mation gain and the measurement detection probability 
for any quantum bit seal However, his bound is not 
tight. In contrast, Chau proved that all imperfect quan- 
tum bit seals are insecure by giving an explicit measure- 
ment strategy. In addition, he obtained a lower bound for 
the fidelity of the resultant quantum state after a mea- 
surement. More importantly, this lower bound is greater 
than 1/2 and is attainable by certain quantum sealing 
schemes [8]. 

The insecurity proof by Chau in Ref. [1] relies heavily 
on the properties of trace distance between two density 
matrices. Generalizing his proof to the case of sealing 
more than two classical states is not straight-forward. 
Furthermore, the security analysis of quantum string 
commitment by Buhrman et al. illustrated two 

important points. First, more than one inequivalent se- 
curity parameters may exist for a quantum string cryp- 
tographic scheme; and second, the security of a quantum 
string cryptographic scheme may be very different from 
that of a quantum bit one. Therefore, it is important to 
study the security of quantum string seal thoroughly. 

In this Paper, I analyze the information disturbance 
tradeoff for a general quantum seal that maps a fixed 
number N of distinct classical messages to N density ma- 
trices. Moreover, the probabilities of occurrence of these 
classical messages need not be equal. I begin by introduc- 
ing the general formalism and the security requirements 
for a quantum seal as well as the notion of the most 
stringent quantum seal in Sec. [Til Then I report a mea- 
surement strategy that obtains non-zero amount of infor- 
mation on the original message and introduce two perfor- 
mance measures in Sec. IIIII I also prove the optimality 
of this measurement strategy against the most stringent 
quantum seal under one of the performance measures. 
And I also argue that this strategy also performs well 
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under the other performance measure in Sec. IIIII Using 
these information disturbance analyses, I show that all 
imperfect quantum seals, including quantum string seals 
in which N = 2", are insecure in Sec. IIVI Finally, a 
summary is given in Sec. |Vl 

II. QUANTUM SEAL 

A. Quantum seal and its security requirements 

A quantum seal is a scheme for Alice to encode a fixed 
number N of distinct classical messages as publicly acces- 
sible quantum mixed states known as the sealed states. 
(Although iV is a fixed integer and the dimension of the 
sealed states is finite, readers can check that the proofs 
and discussions reported in this paper can be easily ex- 
tended to the case when the number of distinct classical 
messages N as well as the dimension of the quantum 
mixed states involved are infinite.) It has to satisfy: 

1. Any member of the public, say Bob, can correctly 
determine a significant portion of the original clas- 
sical message chosen by Alice, known as the sealed 
message, with non- negligible probability by a mea- 
surement. 

2. Any such measurement in criterion [T] must disturb 
the sealed state so that an authorized verifier may 
correctly detect the measurement with non-zero 
(unconditional) probability. 

3. Criterion [2] still holds after replacing the uncon- 
ditional probability by the probability conditioned 
on Bob's successful determination of a significant 
portion of the sealed message. 

In the language of information theory, criterion [1] 
means that the mutual information on the sealed message 
obtained by Bob divided by the entropy of the original 
classical message is of order of 1. Clearly, this criterion 
is necessary; for otherwise, even an honest Bob has negli- 
gible chance to obtain a significant fraction of the sealed 
message. 

The maximum probability for Bob to correctly de- 
termine the sealed message can be made close to 1/iV. 
Nonetheless, in order to satisfy criterion [Tl there exists 
a partition *p of the N distinct classical messages with 
log 1^5 1 < logA^ such that the maximum probability of 
correctly determining which set in the partition the origi- 
nal message belongs to is much greater than . (Let's 
use He's quantum string scheme as an example to illus- 
trate this point. Although it is not likely to correctly ex- 
tract the entire sealed string in He's scheme, it is highly 
probable to correctly determine, say, the first 99% of the 
sealed string Q. In fact, one possible choice of *p in 
this case is to partition according to the values of the 
first 99% of the original message string.) Through the 
partition the quantum seal that encodes N distinct 



classical messages can be regarded as a seal that encodes 
distinct classical messages. With this identification 
in mind, I may assume from now on that the maximum 
probability of correctly finding the original classical mes- 
sage Pmax to be much greater than Furthermore, 
without loss of generality, I label these N classical mes- 
sages by 0, 1, . . . , A'^ — 1 in such a way that the a priori 
probability of occurrence r]i for the message i obeys the 

constraints 770 > f?i > • • • > Vn-i > and X^iLo^ ~ ^■ 
A quantum sealing scheme is called a quantum bit seal 
a N = 2 and a quantum (bit) string seal UN — 2". 
Moreover, the scheme is perfect if Bob can determine 
the entire classical message with certainty; otherwise, the 
scheme is imperfect Q. 

B. A game-theoretic formulation of the problem 

Quantum seal is in some sense a game between Alice 
and Bob. For a given sealing scheme used by Alice, Bob 
tries to gain as much information on the sealed message 
as possible on the one hand and to reduce the chance 
of being caught by the verifier on the other hand. And 
Alice surely wants to pick a sealing scheme that makes 
Bob's task as difficult as possible. 

To analyze the security of quantum seals, all sealed 
states can be assumed to be pure as using purified states 
increase the verifier's chance to detect Bob's measure- 
ment [1]. Using the notation used in Ref. the sealed 
state for message i is 

li'i) = ^>^tj\^tj)B'»\(t)j)A (1) 
j 

for all i, where are normalized states that are not 

necessarily mutually orthogonal, and \(j)j)'s are orthonor- 
mal states. Note that particles labeled by the subscript 
"B" in Eq. ([T]) are publicly accessible, and those labeled 
by the subscript "A" are accessible only to authorized 
verifiers. Thus, the state of the publicly accessible parti- 
cles is 

p, = ^|A,,f|V.,,)(7/;.,| . (2) 
j 

if the sealed message is i. 

Bob's attempt to obtain some information on the clas- 
sical message can be described by a positive operator- 
valued measure (POVM) measurement £ on the publicly 
accessible particles. From the verifier's point of view, 
this measurement changes the sealed state to 

£®Iim{i^^\) = £m{4^^\). 

I write £ = X]j=o where Cj is the superoperator 
describing Bob's action when he concludes that the sealed 
message is j. Then, the probability that Alice's original 
message is i and Bob's measurement on the sealed state 
yields j is given by 

Pry = 77,Tr[£, ® /(|i^.)(^.|)] = r,^^4^JiH^){^^\)] ■ (3) 
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In addition, Bob's mutual information on the original 
message equals 

X = T{£) = I{£) 

= -J2vi logs "l^-YliYl ^'■'^■J' ) ^°S2 ( P^'^J ) 

i j \ k, / \ h / 

+ ^Pry log2Pry . (4) 



A simple way to measure Bob's average chance of being 
caught is to compute the average fidelity of the sealed 
state namely, 



N-l 



F : 



F{£) = F{i) = V^{4'^\Si\4'^){4'^m 



(5) 



1=0 



In other words, the average fidelity (or fidelity for short) 
F measures the mean disturbance caused by Bob's mea- 
surement £. Since 1 — F is the probability of detecting 
Bob's measurement, F is a performance indicator for cri- 
terion [5] stated in Subsec. fll Al 

Bob's chance of being caught given that he correctly 
determined the sealed message is reflected in the average 
fidelity of the sealed state conditional on Bob's success 
^Lond, namely. 



Fr, 



-^cond(^) — -^cond(^) 



E 

i=0 



ri^ {ip^\Ci{\ipt){ip,\)\ip, 



(6) 



(Note that those terms with Tr[£i{\ipi){ipi\)] = in the 
above equation are regarded as 0.) Thus, the average con- 
ditional fidelity (or conditional fidelity for short) i^cond 
measures the mean disturbance caused by Bob's mea- 
surement £ conditioned on his successful recovery of the 
sealed message. Since 1 — Fcond is the probability of de- 
tecting Bob's measurement conditioned on Bob's success- 
ful recovery of the sealed message, -Fcond is a performance 
indicator for criterion [3] in Subsec. Ill Al 

I denote the probability of correctly determining the 
sealed message using the POVM measurement £ hy p. 
Surely, p < Pmax- Furthermore, I assume p > l/N as 
no one is interested in those £'s that perform worse than 
random guessing. (Interestingly, the scheme with r]i = 
1/iV and Pi = pj for all i,j illustrates that p may not be 
less than l/N.) 

Amongst all the POVM's whose probability of cor- 
rectly determining the sealed message is p, Bob would 
like to pick the one that minimizes the average chance of 
being detected by a verifier (and hence maximizes F). In 
contrast, Alice would like to pick a seal that minimizes 
F. Thus, the average fidehty miuAUcc maxBob -F'(p,Pinax) 
for the optimal measurement strategy against the most 
stringent seal is found by first taking the maximum over 
all possible POVM measurements £'s used by Bob whose 
probability of correctly determining the original message 



is p for a given sealing scheme, and then by taking the 
minimum over all quantum seals with maximum proba- 
bility of correctly determining the message Pmax by Al- 
ice [8|. The average conditional fidelity for the optimal 
measurement strategy against the most stringent seal 
minAiiccmaxBob -F'cond(p,Pmax) is similarly defined. 

Since F and -Fcond are two different performance 
indicators, one expects that miuAiicc maxBob F and 
miuAiice maxBob ^cond havc to be attained by two dif- 
ferent sealing schemes and measurement strategies. I 
show in Sec. IIIII that this is indeed the case for a gen- 
eral N. Nevertheless, for N < 5, optimal sealing scheme 
and measurement strategies as reflected by the two per- 
formance indicators can be chosen to be the same. 



III. THE OPTIMAL MEASUREMENT 
STRATEGY 

A. A measurement strategy and its performance 

Obviously, Pmax is equal to the maximum probability 
of correctly distinguishing the mixed states pi's with a 
priori occurrence probabilities ry^'s. The set of POVM 
elements jll fcl^^ "^ that maximizes such a probability is 
given by [ll|, Il2j 



and 



YviPi^t - VjPj > 



(7) 



(8) 



for all < j. A; < TV — 1. In other words, Pmax and Hi's 
satisfy the equation 

N-l N-l 
Pmax — Y ?7^Tr(n,p,) = Y ® ■ (9) 

i=0 i=0 

Clearly, l/N < rjo < Pmax < 1. In fact, p^ax = l/N if 
and only if pi = pj for all i,j; and Pmax = 1 if and only 
if Pi's are mutually orthogonal. 

I write the spectral decomposition of 11^ as 



(10) 



where {|eij )}j are complete sets of orthonormal state kets 
for all i and pij > for all Based on the Hi's, I 
construct 



1 - 1/ 



1/2 

+ ) |e,j-)(ey| , (11) 



where 



V = i^(p,Pmax, A^) 



pN~l 

Pma^N - 1 



(12) 



4 



for all p G [1/iV, 1]. Clearly, f e [0, 1] and hence MiS are 
well-defined measurement operators. I denote the POVM 
measurement with Kraus operators {Mij^J^^ by £p,p^^^ 
for 



1 - V 
N 



^ ?7,Tr(n,;p,) =p . 

i=0 

(13) 

Using the POVM measurement £p,p^^^, the probabil- 
ity that Alice's original classical message is i and Bob's 
measurement on the sealed state yields j is equal to 



'-tj 'It I \'^''^ J 



N 



(14) 



In particular, if p,Pmax are large and v is close to 1, then 
Pr^i is generally much larger than Pr^ for j ^ i. Conse- 
quently, the mutual information X is close to the maxi- 
mum possible value of — J^i Vi log2 Vi- (For example, in 
the He's scheme Bob's mutual information obtained 
by the POVM fp„^^,p„,^^ on the sealed message equals 
/ = 0.99n[l -I- e log2 e -I- (1 — e) logj e] where e is the small 
control parameter in his scheme.) 

To investigate the disturbance caused by this POVM 
measurement, I use the following lemma. 

Lemma 1. Let < ly < 1. Then, 



/(^) 



1 - ly 
N 



N 



1 - V 
N 



l-v 

N 



x>0 (15) 



for all X e [0, 1]. Besides, the equality holds if and only 
if X = or 1. 

Proof. By solving the equation df/dx — and consid- 
ering d'^f/dx'^, I find that the continuous function f{x) 
has a single local maximum in the interval [0, 1]. Hence, 
f{x) > min(/(0),/(l)) = for all x e [0,1]. Moreover, 
f{x) = if and only if a; = or 1. □ 

A direct consequence of Lemma [T] is that 



tute Eq. (HH) into Eq. ^ to obtain 
min maxF(p 

Alice Bob 

N-l 2 

> Y m\{'4'^\al®l + bIlj(S)I\iij,) 

= Na^ + 2ab + b' J2 T],\{4^^\Uj®I\4>,)\ . (17) 
Subjected to the constraints in Eq. @ and 

^(7/.,|H,®/iv;,) = 1 (18) 

for all i, the last line of Eq. ([TT]) is minimized if 



Pmax if i = j 



TV- 1 



if i 7^ j 



(19) 



Consequently, 



min maxF(p,pmax) 

Alice Bob 



> 1 



1-V 



1-K 



N \ N 

_ (1 - Pmax)^ 

N - 1 



(20) 



for all 1/A^ < p < Pinax, where v is given by Eq. ([l3 

To find a lower bound for miuAiico rnaxBob ^cond, I sub- 
stitute Eq. (fT6)) into Eq. ([6]) to obtain 

min max f'cond (p, Pmax) 

Alice Bob 



— -^COnd (^p.pniax ) 



(21) 



Note that the function g(x) = (a -|- hx)'^ l{c? -I- vx^ is 
convex for any a, b,u,x > 0. So by applying Jensen's 
inequality to the right hand side of Eq. pT|) and by using 
Eq. ([9]), I conclude that 



P / N ^ (a-t-6pmax) 

mmmaxFco„d(p,Pmax) > 

Alice Bob -|- t'Pmax 

_ {a + bpmaxf 



(22) 



v^—r— - \ —— H, 



N \\l N \l N 

= a{v, N)I + b{v, iV)H,; = al + 6H,; (16) 



B. The optimality of the measurement strategy 
with respected to the average fidelity performance 



measure 



for all i. And the equality holds if and only if H.^ is a 
projector. 

To find a lower bound for minAiico niaxBob F , I substi- 



For an arbitrary quantum seal chosen by Alice, it may 
be possible to find a POVM measurement £, whose prob- 
ability of correctly determining the sealed message equals 
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p, satisfying F{£) > F{£p,p^^^). However, Alice may 
choose the quantum seal reported in the next paragraph. 
It turns out that the value of F{£) for this seal is upper- 
bounded by the right hand side of Eq. ^U\\ . This makes 
an optimal measurement strategy for Bob when 



using F as the performance indicator. 

Consider the quantum sealing scheme with rji 
and 



l/N 



^^^^El-?')B®b')A®K>A (23) 



for 1 = 0, 1,...,A^— 1, where each of the three quantum 
registers used in the above scheme is A'^-dimensional with 
basis It is straight-forward to check that \'4>i)^s 

are orthonormal and that 



TrA(|^,)(V'j|) =Pmax|i)(«l + ^^^"-j" 

(PmaxiV- + (1 -Pmax)/ 

N -1 

c(Pmax,A^)N)(i| + rfbmax.iV)/ 

c\i){i\ + dl . 



(24) 



Now I show that this sealing scheme is the most strin- 
gent one in the sense that the resultant fidelity of the 
quantum state after any POVM measurement by Bob is 
upper-bounded by the right hand side of Eq. ([20|). Recall 
that £ can be written as X^il^o^ where Ci is the super- 
operator describing Bob's action when he concludes that 
the sealed message is i. In general, the action of each Ci 
on a density matrix p can be written as 



A(p) ^J^^'^P^h 



(25) 



after Bob has applied the POVM £ is given by 
^ = ^El^(*l^j'=l*)+'^Tr(g,fc)|2 



- C E \i'\Q^'^\')\' + did + 1^) E |Tr(Q,fc)f 



ijj.k.m 

+ d{d+^)Y,\TTiQ,,)\' 



d{d 



N 
2c 

n' 



ElTr(Q 



Jk) 



(28) 



3,k 



where the equality holds if and only if (i|Qjfc|"^) — 
for all i ^ m. Subjected to the constraints in Eqs. 
and (|27p . the last line of Eq. ((28|) is maximized if 



QiQ 



Pn 



PmaxA^ 



:^Eb')01 



ail', N)I + h{v, N)\i){i\ 



(29) 



and Qij = for all j ^ 0. (Note that although this set of 
Qij's is not unique, it is straight-forward to check that all 
Qy's that maximizes F are equivalent in the sense that 
they give the same POVM £.) In addition, the maxi- 
mum probability Pmax of distinguishing p^'s is attained 
by the measurement operators |i)(«|'s as these operators 
satisfy Eqs. O and Therefore, QiQ = Mi for all i 
and hence £ = £p,p^^^- Consequently, for this particular 
quantum seal chosen by Alice, F is at most equal to the 
right hand side of Eq. pp)) . Besides, such an equality 
can be obtained by using the POVM £p,p^^^- That is 
to say, £p.p^^^ is an optimal measurement strategy for 
Bob with respected to the average fidelity performance 
measure when Alice uses the sealing scheme in Eq. 



Clearly, Q^ 's satisfy 



and 



1,3 



(26) 



(27) 



C. Analysis of the measurement strategy with 
respected to the average conditional fidelity 
performance measure 



Using the same notation as in Subsec. IIIIBi the aver- 
age conditional fidelity of the state after Bob has applied 
the POVM £ to the quantum seal in Eq. (|23p equals 



-E 



E,|c(i|Qy|i)-f dTr(Q, 



^ E, c(*|Ql^.Q,,|*)+dTr(Q|,Q„) 



From Eqs. © and the average fidelity of the state for a fixed value of c(i|Q^Qy |i) dTr(Qj^.Qy ) 



(30) 

By constrained extremization, it is easy to show that 

the 
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ith term in the above equation is maximized if (1) Qij = 
for all j ^ 0, (2) \k) is an eigenvector of Qm whose 
eigenvalue > for all fc, (3) r^fc = Tik' for all 
k,k' ^ i, and (4) tu > Tik for all k ^ i. However, 
one cannot jump to the conclusion that f'cond is maxi- 
mized by picking Qio = a{i^, N)I + b{v, N)\i){i\. Actu- 
ally, this conclusion is wrong in general. A counterex- 
ample is given below: let N = 8, Pmax = 0.9 and 
p_ = 0.3. By choosing = a{v,N)I + b{v,N)\i){i\, 
^cond — 0.980204. In contrast, by choosing Q^q = 



3(2V47|z)(i| + ^Ei/i |j)01)/l5V3T for z = 0, 1, . . . , 5 
and Q,o = (2yT09K)(i| + 3V29Ej^Jj)01)/5V3T for 
i = 6,7, then Fcond ^ 0.981247. That is to say, for 
Pmax = 0.9 and p = 0.3, the Fcond caused by a cer- 
tain asymmetric set of Kraus operators {Qio} (in the 
sense that there exist j,j such that Qio ^ UQjoU^^ 
for some permutation operation U of the standard ba- 
sis) is greater than that caused by a symmetric set of 
Kraus operators. In fact, this symmetry breaking phe- 
nomenon is partly due to the fact that -FcondliS^), unlike 
F{£), is not a linear function of £ . And the nonlinear 
dependence of Fcond on £ makes the determination of 
miuAiice maxBob -F'cond(p,Pmax) difficult. 

In spite of this difficulty, the function 
minAiiccmaxBob-FcondbiPmax) can be found in the 
following three special cases: (1) iV < 5, (2) p = 



and (3) p = Pmax- 

For the first case 
maximization, the ith 
bounded by h(xi) 
h{v{xi,pma^, N), N)p 

max 



[N < 5), by constrained 
term in Eq. pop is upper- 

= [a{l'{xi,Pnie,K,N),N) + 

'^/xi, where Xi = 



[c{i\Ql,Q^j\i) + dTr(gtO,,)J / E, Tr(Q^Q,,). Ob- 
serve that h{x) is concave for < 5 and p £ [l/A^,Pmax]- 
(One way to see this is to use Mathematica to check 
that h"{p) < 0.) Therefore, Eq. ((SO]) is upper bounded 
by h{p) = (a + &Pinax)^/p if A^ < 5. Surely, this upper 
bound is attained by picking the POVM £p.p^^^, namely, 
the one that also maximizes the performance indicator 
F. 

The second case {p — \ /N) is trivial as Eq. implies 
that the average conditional fidelity of the state after 
applying £i/n,p^^^ equals 1. 

For the third case {p = Pmax), the symmetry of the 
quantum seal in Eq. (|23p demands that the denominator 
in each term of the sum in Eq. (j30p must all equal to 
Pmax- Using the same constrained maximization analysis 
in the first case, each term in Eq. (|30p is upper-bounded 



by /l(Pmax) = Pn 



Hence, 



cond 



< 



Pn 



in this case. 



Moreover, this upper bound is attained by the POVM 
f 

*-'Pmax,Pmax " 

In summary, I have proven 



J 



Theorem 1. Let 1/N < p < Pmax- Then, 



mmma.x F{p,p^ax) = 1 

Alice Bob 




^~pi 



(1 Pmax}'' 

N - 1 



(31) 



and 



min max Fcond{p, Pmax) > 
Alice Bob 



(32) 



where v is given by Eq. il2\}. In particular, Eq. iS^) is an equality if p = l/N,pmax or N < 5. Furthermore, 



min max F{pmaxi Pmax) = P' 
Alice Bob 



2 

max 



A^- 1 



(33) 



Xa.mm3JKFcond{Pmax,Pm.ax) = Pr. 
Alice Bob 



(34) 



Figs. [U and [2 show minAUco maxBob -F(p,pmax) and 
niiUAlicc UiaXBob -^cond (p,Pmax) VS. p for different 

Pmax 

when = 2,4. Note that min Alice maxBob -^'(p ; Pmax } 
and min Alice maxBob ^cond(P5 Pmax) are discontinuous at 
p = 1/N whenever Pmax > l/A". This discontinuity orig- 
inates from the sudden change in the dimension of the 
set {pi}^o^ around the point p = 1/A^ 0. Besides, 



minAiiccmaxBob^'(p,Pmax)_-^ l-p(l-p^jj,,)/pniax- Notc 
also that miuAUco maxBob ^(p,Pmax) is a concave func- 
tion of p for a fixed value of Pmax for F{£) is a linear 
function of £. 

Finally, I remark that derivations of the upper 
and lower bounds for miuAiicc niaxBob ^^(p,Pmax) and 
minAiiconiaxBob-Fl:ond(p,Pmax) reported in this Section 
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FIG. 1: (Color online) Dotted curves show 

minAiicc maxBob f'(p,Pmax) vs. p for various values of 
Pmax with (a) A'^ = 2 and (b) = 4. The solid curves show 
the case of p = Pmax- 



half of the time. Hence, all quantum seals are insecure. 

In fact, the major loophole in He's proof of the security 
of his quantum string seal in Rcf. [5] is that he incorrectly 
assumed that measuring all the qubits is the only method 
to obtain a significant portion of information of the sealed 
message. 

Recently, He proposed the following method of attack 
[r3 |: Bob measures the sealed message using H^'s as the 
POVM elements with probability 1/2; and he randomly 
guesses the sealed message without actually measuring 
otherwise. His mixed strategy escapes verifier's detec- 
tion at least half of the time (as measured by F) and 
obtains non-trivial information on the sealed message. 
Nevertheless, Fcond of this strategy approaches Pmax/2 
as iV — * cxD. Compared with Theorem [Tl the average 
conditional fidelity of He's attack is only about 1/2 that 
of the optimal strategy. 
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FIG. 2: (Color online) Dotted curves show 

minAiice maxBob f'cond(p,Pmax) VS. p ioi various values 
of Pmax with (a) A'' = 2 and (b) A'' = 4. The solid curves 
show the case of p = pmax- 

are also valid in the case of determining partial infor- 
mation on the original message via the partition *p. 



IV. PROOF OF INSECURITY OF QUANTUM 
SEAL 

Although the functional form of 
minAiiccmaxBob^'cond(p,?3max) is not known for > 5 
and 1/7V < p < Pmax, its lower bound stated in Theo- 
rem [1] is already sufficiently stringent to help proving the 
insecurity of quantum seal. Specifically, to fix = 1/2 
by choosing the appropriate p, Theorem [1] implies 
the existence of a POVM measurement £p,p^^^ that 
make both miuAUco maxBob F and miuAiicc maxBob ^iiond 
greater than 1/2 for all N > 2. In other words, this 
measurement obtains non-trivial information on the 
sealed message and escapes verifier's detection at least 



V. CONCLUSIONS 

To summarize, I have extended the study of informa- 
tion disturbance tradeoff for quantum bit seal Q to the 
case of quantum string seal. Specifically, I show that 
the average fidelity and average conditional fidelity of 
the measured state is greater than or equal to the right 
hand side of Eqs. ([?T|) and ([5^ . respectively. Further- 
more, the equalities are simultaneously attained by a 
specific quantum sealing scheme provided that N < 5 
or p = 1/N^p^ii^. A consequence of this information 
disturbance tradeoff expression is that all quantum seals 
are insecure provided that one has access to a quantum 
computer. 

One of the major reasons I can extend the earlier result 
on quantum bit seal in Ref. Q here is that I replace the 
classical Li distance by the probability of distinguishing 
two classical probability distributions. The later concept 
readily extends to the case of A^ > 2. Actually, it can 
be shown that for N = 2 the measurement £p^p^^^ to- 
gether with the expression for minAiice maxBQh F{p, Pmax) 
are the same as the ones reported in Ref. Q. I also re- 
mark that even though I consider only the case of sealing 
finite number of messages, the arguments used in this 
Paper can be easily extended to cover the case of seal- 
ing infinite number of messages using states in an infinite 
dimensional Hilbert space. 

Although quantum seal is not unconditionally secure, 
the construction of i?p,p,„-,x requires Bob to find the 
POVM measurement {H^} that distinguish the density 
matrices pi 's with a priori probability r]i 's with minimum 
error. In general, it is difficult to explicitly find the Hj's; 
and a quantum computer is needed to implement £p,p^^^ ■ 
So, it may be possible to construct a quantum seal that 
is secure under certain computational or hardware as- 
sumptions. Last but not least, it is instructive to find 
miuAiicc maxBob -F'cond for A^ > 5 and l/N < p < Pmax- 
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